Announcements & Breaking Changes

• onnxruntime-web has announced the deprecation of WebGL and JSEP. The native WebGPU EP is the recommended path going forward. See the deprecation and migration plans for details (#29716, #31683).
• POSIX telemetry is now available on Linux, macOS, Android, and iOS when ONNX Runtime is built with telemetry enabled. It does not change the public ABI, WebAssembly remains telemetry-free, and setting ORT_DISABLE_TELEMETRY=1 before initialization disables non-Windows telemetry for the process (#27379, #29872).
• The unused internal onnxruntime/python/tools/tensorrt dashboard tooling was removed. This does not affect the TensorRT Execution Provider APIs (#29395).

Security Fixes

Path, bounds, and input validation

• Fixed a path traversal vulnerability in TensorRT and NvTensorRTRTX engine refitting by making external-data path validation unconditional (#29396).
• Validated the CPU MoE k attribute against the number of experts and fixed a CPU TensorScatter security issue (#29907, #29916).
• Added missing rank, shape, and parameter validation for pooling, LSTM and DynamicQuantizeLSTM, Sampling, FeatureVectorizer, SkipLayerNorm, QLinearConv, Whisper decoding, RNN activations, GridSample, contrib Range, and CropAndResize (#29254, #29255, #29265, #29579, #29595, #29605, #29871, #31636, #31671, #31675, #31676, #31684).
• Hardened CUDA indexing and buffer handling in GridSample, transpose, GatherBlockQuantized, InstanceNormalization, LayerNorm/RMSNorm, BeamSearch, DeformConv, AveragePool, and MaxPool (#29581, #29631, #29638, #31640, #31642, #31644, #31645, #31647, #31650).
• Fixed packed sub-byte tensor over-copying in OrtApi::GetValue and validated DML constant tensor byte sizes (#29157, #31665).

Supply chain and tooling

• Updated npm lockfiles, refreshed the Next.js end-to-end fixture lockfile for security advisories, and upgraded adm-zip for onnxruntime-node (#29827, #29926, #31192).

New Features

Core APIs & Runtime

• Default intra-op and inter-op thread-pool sizes can now be set with ORT_INTRA_OP_NUM_THREADS and ORT_INTER_OP_NUM_THREADS. Explicit thread settings still take precedence, and 0 preserves machine-sized defaults (#29688).
• Added weightless-model support for all initializer types, allowed zero-input EpContext nodes, and wired maximum-shape inference into workspace estimation (#29607, #29799, #31613).
• Added ONNX-domain support for rotary embedding and a fused MRotaryEmbedding contrib operator for Qwen mRoPE variants (#29261, #31728).
• Added multi-shape profiling to onnxruntime_perf_test through --data_shape, plus verbose graph-transformer tracing and broader inference-session error-path coverage (#29555, #29558, #29569, #29571).

Execution Provider ABI & Plugin EPs

• WebGPU now supports device-free compile-only sessions for offline graph transformation (#29681).
• Expanded CUDA plugin EP packaging and testing, including Windows ARM64 package and size options, updated package outputs, and aligned architecture selections across Python, C API, TensorRT, Node.js, and plugin packages (#31635, #31722, #31992).
• Improved plugin lifecycle handling by unloading failed EP library loads and fixing allocator-deleter lifetime (#29634, #29770).

Execution Provider Updates

NVIDIA CUDA EP

Attention and decoding

• Added PagedAttention with quantized KV cache, XQA decode, MLA, QK-Norm, and head-sink support (#29912).
• Extended quantized KV-cache support with attention sinks, independent and per-channel scales, sliding-window cache support, and a fused K/V dequantization launch (#29900, #29904, #31480).
• Added a cuDNN SDPA decode tier to the standard ONNX Attention CUDA kernel and enabled cuDNN SDPA for contrib Attention (#29715, #29717).
• Added attention_bias support to the GroupQueryAttention unfused path and state_window support to LinearAttention and CausalConvWithState for MTP (#29525, #31157).
• Fixed LinearAttention on GPUs with limited shared memory (#31982).

MoE and quantized GEMM

• Added NVFP4 QMoE, including native FP4xFP4 prefill on SM120, faster decode GEMV, fused routing/finalization paths, and reduced activation and weight-dequantization overhead (#29697, #29824, #29887, #29919, #31156, #31159, #31349, #31479).
• Added MatMulBlockQuantizedFp4Weight and MatMulBlockQuantizedFp8Weight, plus block-scaled tensor-core/GEMV decode paths, packed FP4 decode, M-tiling, and folded W8A8 activation QDQ (#29818, #29850, #29896, #31155, #31481).
• Improved MatMulNBits and QMoE robustness and efficiency by optimizing 8-bit dequantization, releasing raw MXFP4 initializers after prepack, and fixing subgraph prepacking and mixed FP8/FP4 build failures (#29852, #31141, #31154, #31350).

Operators and collectives

• Added LinearAttentionGate, GatedRMSNorm, and GatedAdd contrib operators (#31158, #31835).
• Added bfloat16 support to AllReduce, AllGather, and AllToAll (#31571).
• Fixed the default zero point in CUDA GatherBlockQuantized (#31693).

WebGPU EP

• Added DFT, HardSwish, Max/Min, Trilu, GRU, PRelu, MatMulBnb4, and MRotaryEmbedding support (#29454, #29587, #29828, #29833, #29840, #29845, #30512, #31976).
• Expanded integer support across Clip, Reshape, Cast, Add, Tile, Concat, Expand, Gather, CumSum, Max, and Min (#29830, #29834, #29835, #29839, #29844, #29847, #29854, #29861, #29897, #29918, #31049, #31702, #31709).
• Added the initial WebGPU PagedAttention implementation and moved Softmax and non-flash Attention to online algorithms (#29694, #29724, #31611).
• Improved MatMulNBits wide-tile accumulation precision (#29611).
• Added and extended Intel subgroup-matrix MatMul/Gemm kernels, including f16, batched-B, and odd-N support (#29592, #29749, #29813, #29893).
• Reduced cold-start and upload overhead with deferred dispatch and staging-buffer improvements; tuned FlashAttention, subgroup Gemm/MatMul, Split-K on Panther Lake, and Xe im2col-matmul (#29271, #29505, #29557, #29586, #29846, #30514).
• Upgraded Dawn and improved reliability by avoiding exceptions in Dawn callbacks, fixing a Linux adapter-failure self-deadlock, correcting Windows x86 transfer callbacks, and fixing TurboQuant batched sequence lengths (#29389, #29591, #29625, #29752, #31568).

WebNN EP

• Added uint8-packed 4-bit GatherBlockQuantized and LpNormalization, reused the shared WASM loader for Blob-backed external data, and fixed per-axis QDQ and MatMulNBits edge cases (#29475, #29801, #31151, #31152, #31197).

OpenVINO / QNN / DML / XNNPACK / TensorRT

• OpenVINO fixed float16 constant-output corruption and output-name routing, added dot-separated KV-cache names to the stateful transform, and corrected raw-data-backed float initializer handling (#29729, #29882, #29895, #31138).
• QNN added a reshape handler for split-axis reshapes (#29660).
• DML fixed wide-string handling and made fused graph kernels own their model paths (#31656, #31664).
• XNNPACK now reads dynamic Gemm M from the input tensor at compute time (#31189).
• TensorRT deduplicated context-path handling and added a build option for fused-attention cubins (#29640, #31632).

CPU & Core Optimizations

MLAS

• Added Arm64 half-precision GEMM and convolution support through KleidiAI, including FP16 MatMul/Gemm/Conv paths and asymmetric Q4 and SME2 MatMulNBits kernels (#28786, #29654, #29709, #29898).
• Added a RISC-V RVV QNBitGemm backend, an Arm64 NEON fp32 RoPE kernel, portable SVE elementwise kernels with FEXPA exp, and Arm64 UDOT routing for S8U8 QGEMM (#29537, #29787, #29836, #31145).
• Added AVX2/VNNI 2-bit weight kernels and vectorized 2-bit dequantization, and improved fp16 MatMulNBits paths by avoiding fp32 temporaries and writing fp16 output directly across 2-, 4-, and 8-bit paths (#29619, #29766, #29791, #29842, #29864, #29901).

CPU Attention & Kernels

• Improved masked Attention performance, enabled CPU FlashAttention on Linux Arm64 through L2-cache detection, and added FP16 GQA with quantized KV cache (#29621, #29719, #29825).
• Added double support to CPU Cos and int32 support to CPU Trilu, and fixed int8 QLinearSoftmax saturation and AvgPool ceil_mode/count_include_pad behavior (#28975, #29476, #29629, #29728).
• Fixed TfIdfVectorizer weight indexing and skipped MinLength logits-processor construction when eos_token_id is negative (#29604, #31649).
• Tightened K/V and cache-indirection shape contracts in CPU Attention and MultiHeadAttention, and fixed LinearAttention output shape inference for grouped-query attention (#29892, #31190, #31634).

Graph, Optimizer, and Runtime

• Extended reshape fusion, fixed double recursion in subgraph type/shape inference, and made constant-folding output deterministic (#29027, #29617, #29789).
• Fixed in-memory external initializer loading, memory-pattern allocation stream selection, and a leak in GetOverridableInitializerNames() (#29349, #29589, #29616).
• Reduced small MatMul batch allocations and redundant LUT initialization (#29085, #29690).
• Fixed static-initialization-order crashes when importing ONNX Runtime and reduced eager runtime initialization (#29880, #31964).
• Negative CPU Split axes now produce an error instead of being accepted (#31149).

Web & JavaScript

• Added on-demand loading of Blob-backed external data in JSPI builds (#29477).
• Fixed JSEP pooling output shape for ceil_mode, allowed DFT to ignore excess input data, and fixed a webpack/Terser release-build crash (#29627, #29680, #31652).

Build, Packaging & CI

• CUDA package architecture selections are now aligned across plugin EP, Python, C API, TensorRT, and Node.js pipelines. Windows arm64 is only available in CUDA plugin EP (#31992):

  OS	CUDA	CUDA architectures (all in -real form)
  Linux x64	12.8	60;70;75;80;86;89;90a;120a
  Linux x64	13.x	75;80;86;89;90a;120a
  Linux aarch64	13.x	89;90a;120a;121a
  Windows x64	12.8	61;75;86;89;120a
  Windows x64	13.x	75;80;86;89;120a
  Windows arm64	13.x	120a;121a

• Reduced CUDA compilation time and memory usage by splitting generated SM80 MoE, fpA_intB, and MatMulNBits translation units and adding two-level workspace estimation (#29614, #29699, #29811, #31834, #31837).

• Fixed CUDA 13 plugin and packaging builds on Windows, Linux, and Windows ARM64, including MSVC/TMA compatibility and CI memory limits (#31608, #31609, #31615, #31616, #31617, #31622, #31729, #31748).

• Fixed MLAS AVX2 builds on toolchains without AVX-VNNI assembler support, GCC 15 -Werror builds, and an MSVC C1001 issue in the W2 AVX-512-VNNI dispatch path (#28767, #29679, #29885).

• Improved Windows compatibility by skipping DXGI discovery when Win32k system calls are unavailable and delay-loading shell32 (#29755, #30889).

• Fixed Dawn parallel-build races, and GPU discovery in build/test environments (#29858, #29866).

Contributors

Thanks to our 63 contributors for this release!

@adrastogi, @ahsan-ca, @AngelGalindo7, @ankitm3k, @apsonawane, @blazingphoenix7, @bmehta001, @chilo-ms, @claude, @daijh, @ducviet00, @edgchen1, @elwhyjay, @eserscor, @GopalakrishnanN, @guptaishaan, @hariharans29, @Honry, @huningxin, @jchen10, @jiafatom, @jiangzhuo, @Jiawei-Shao, @JonathanC-ARM, @justinchuby, @kjg0724, @kunal-vaishnavi, @kylo5aby, @Laan33, @martin-klacer-arm, @mastryukov1990, @mcollinswisc, @miaobin, @mingmingtasd, @mirounga, @mustjab, @n1harika, @namgyu-youn, @neilmsft, @nenad1002, @nicholascelestin, @OscarFree, @prathikr, @qjia7, @quic-muchhsu, @Sammy-Dabbas, @sanaa-hamel-microsoft, @shiyi9801, @skottmckay, @tairenpiao, @TedThemistokleous, @the0cp, @tianleiwu, @titaiwangms, @velonica0, @wangw-1991, @wuisabel-gif, @xadupre, @xhcao, @xiaofeihan1, @xiaoyu-work, @yen-shi, @zlma7001

Full Changelog: v1.28.0...v1.29.0

Announcements & Breaking Changes

• Upgraded to ONNX 1.22.0 and protobuf 6.33.5 (#28754, #29606, #28967). Graph optimizer opset version checks were updated accordingly (#28966).
• cuDNN and cuFFT are now optional at runtime for the CUDA EP, and nvrtc is no longer linked, which significantly reduces the required CUDA redistributable footprint (#29252, #29808, #29705, #29620).
• An experimental C/C++ API surface was introduced. OrtModelPackageApi now lives in the experimental C API and may change in future releases (#28746, #29142, #28990).
• Deprecated / removed:
  • SkipLayerNorm strict mode is deprecated (#29388).
  • The TensorRT fused causal attention kernels were removed from the CUDA EP (#29143).
  • The dynamic WGSL generator (duktape/Node) path was removed in favor of the Python wgsl-gen implementation (#29141, #28355).
  • CUDA_QUANT_PREPROCESS is off by default (#29687).
• NPM packages are now published from the CUDA 13 pipeline (#28773).
• The CUDA 12.8 package architecture list was refreshed for this release (#29711).

Security Fixes

Memory safety & input validation

• Hardened the ORT FlatBuffer model loader against malformed buffers, and removed now-redundant table offset validation (#28186, #29068)
• Fixed type confusion in raw-pointer bind_input causing an out-of-bounds write (#28839)
• Fixed out-of-bounds pointer in TensorAt for sub-byte packed types (#28973)
• Fixed arbitrary memory read, out-of-bounds dereference, and other OOB accesses in kernels (#28991, #29011, #29012, #29014)
• Validated Col2Im inputs to prevent heap over-read (#28706)
• Hardened CropAndResize against malformed crop_size tensors (#28766)
• Validated BeamSearch vocab_size against logits width (#28774)
• Fixed bounds in WhisperDecoderSubgraph::CreateInitialFeeds (#29239)
• Validated SparseAttention CSR indices/key lengths and rejected zero-dimension block_row_indices (#29015, #29242)
• Clamped derived sequence lengths and KV-cache index in CUDA GroupQueryAttention, and fixed a CPU GQA out-of-bounds read in the past-KV buffer (#29240, #29447)
• Clamped 1D attention mask_index to valid bounds (#29449)
• Validated MaxpoolWithMask kernel rank against input spatial rank (#29253)
• Rejected CUDA BERT EmbedLayerNorm/SkipLayerNorm shapes exceeding 32-bit output indexing (#29264)
• Fixed the optional-output guard in DecoderAttention/MultiHeadAttention shape inference and negative-axis handling in ExpandDims shape inference (#29268, #29448)
• Fixed TreeEnsemble target id validation and added input validation to LinearClassifier (#29293, #29060)
• Fixed DynamicQuantizeLSTM zero-point/scale validation typos (#29462)
• Handled non-trivially-copyable types in Loop/Scan output concatenation (#29397)
• Normalized bool tensor raw_data to {0, 1} on unpack (#29238)
• Addressed hardening gaps in Resize, PadFusion, and LoRA handling (#28779, #28780, #28801)
• Fixed unbounded lifetime on WithOutputTensor in the Rust bindings (#29251)

Integer overflow & allocation size

• Guarded MlasConvPrepare working-buffer products and ConvTranspose pad computation with SafeInt (#29444, #29446)
• Fixed signed-int overflow in SamplingState::Init that could cause a heap buffer overflow (#29443)
• Hardened QMoE against integer overflow and partial K tiles (#29067)
• Validated B/scales/zero-points shape in MatMulNBits::PrePack (#29445)
• Pre-checked ConstantOfShape output size against the input initializer before constant folding (#28751)
• Fixed integer overflow in RKNPU implicit bias allocation (#29249)
• Fixed WebGPU out-of-bounds reads in Pad (int64/int32 truncation), Slice, and GatherBlockQuantized (#28721, #28704, #28718)

Supply chain & tooling

• Updated protobuf to mitigate CVE-2026-0994 and bumped ONNX/protobuf to fix additional CVEs (#28967, #29606)
• Avoided shell injection in the training helper and switched Triton compile helpers to subprocess (#28776, #28775)
• Validated archive extraction paths in the transformers tooling (#28777)
• Validated and inlined external data in node tensor attributes during session initialization (#29250)
• Enabled Spectre-mitigated MSVC libraries for BinSkim builds (#29624)
• Bumped npm dependencies: shell-quote, esbuild, tmp, ws, protobufjs, js-yaml, tar, markdown-it, @babel/core (#29022, #29044, #29055, #29057, #29061, #29062, #29063, #29079, #29090, #29156)

New Features

Execution Provider ABI & Plugin EPs

• Model Package support Phase 2, plus authoring tools, schema versioning, and folding external_data into session options (#28271, #28989, #29501)
• Added an API to select the best compiled-model compatibility info from candidate strings (#28387)
• Added crypto support: applications can supply I/O callbacks to an EP, with callback and fallback helpers (#28624)
• Implemented name-based partitioning with accompanying documentation (#28903)
• Added Linux NPU discovery through sysfs accel devices (#28703)
• Relaxed CompileModel validation to accept zero-input OrtModel graphs (#28771)
• CUDA plugin EP: user compute stream with CUDA graph, kernel sync stream exposed for scratch allocation, and Windows ARM64 packages (#29221, #29244, #28896, #28789)
• WebGPU plugin EP version bumped to 0.3.0 (#29056)

Core APIs & Runtime

• Added OrtErrorCode documentation, single-sourced the values so StatusCode stays in sync, and added OrtErrorCode::ORT_DEVICE_RESET (#29018, #29065, #29748)
• Added memory statistics to profiling output (#29058)
• Added EP version logging on inference failure, in the EpDeviceUsage event, and ORT version logging (#28794)
• User-supplied external initializers are now used in place when already on the planned device (#29013)
• model_external_initializers_file_folder_path is now honored for file-path model loads (#29459)
• Added a Python API for HOST_ACCESSIBLE OrtValue allocation (#28038)

Quantization Tooling

• Added CudaQuantizer to onnxruntime.quantization (#29509)
• Registered Flatten as a Direct8Bit op in the Python QDQ static quantizer (#28340)
• Skipped MaxPool during FP8 static quantization and fixed the FP8 (FLOAT8E4M3FN) scale reference distribution (#28488, #29350)
• Added Float16/BFloat16/Float8 support in the TensorArray custom op (#28335)
• Clarified CPU parameter recommendations in the quantization docs (#28415)

Execution Provider Updates

NVIDIA CUDA EP

Attention & LLM decode

• Enabled XQA by default for FP16/BF16 GroupQueryAttention, and extended XQA decode with attention sink, sliding window, and QK-Norm support (#29046, #29162, #29177, #29186)
• Upgraded cudnn_frontend to 1.24 and enabled cuDNN SDPA for MHA/GQA (#28849)
• Added decode-optimized LinearAttention (GatedDeltaNet) kernels (#28985)
• Optimized FlashDecode split planning for local-window GQA and fixed Flash/Lean attention split heuristics (#29161, #29554)
• Updated the GroupQueryAttention contrib op documentation (#29173)

MoE & quantized GEMM

• Prepacked int4/int8 QMoE expert weights in the PrePack hook, symmetric with MatMulNBits, and fixed the prepack to always use the SM80 layout (#28749, #28978, #28965)
• Optimized the QMoE SoftmaxTopK router for small-batch decode, added a Split-K2 SwiGLU GEMV kernel, defaulted to fp16 accumulation for fp16 activations, and fused the MoE router bias into the MatMulNBits GEMV (#28980, #29167, #29166, #29170)
• Added a batched small-M GEMV path for 4-bit/8-bit MatMulNBits (#29451)
• Enabled fpA_intB GEMM in CUDA builds with configurable options, added prepacked fpA_intB weight support, and enabled native SM90, block_size=32, and fused bias (#29622, #29499, #29585)
• Fixed a QMoE profiler cross-stream race and made it CUDA-graph-capture safe (#29584)

Coverage, dependencies & fixes

• Added cuDNN-free ArgMax/ArgMin/ReduceSum and fixed LogSoftmax on the plugin EP (#29620)
• Filled the CUDA opset gap for Softplus and Softsign up to opset 22 (#28982)
• Fixed the XQA GroupQueryAttention cudaErrorInvalidValue on Blackwell (sm_120) (#29706)
• Initialized large-head FMHA shared memory per kernel variant (#29140)
• Fixed CUDA/cuDNN DLL preload paths for the CUDA 13 consolidated wheel layout, and fixed the libcudart.so.13 hard dependency that broke import on CPU-only Linux (#29202, #29590)
• Fixed a null allocator passed to plugin EP kernel PrePack, and plugin EP allocator deleter lifetime (#29658, #29663)
• Removed unused code in moe_kernels.cu (#29295)

WebGPU EP

• Added KV cache quantization for ORT WebGPU (#28059)
• Fused FlashAttention decode kernels and extended them to any sequence length (#28389)
• Fused Q/K RMSNorm into GroupQueryAttention for Qwen3-style models (#28484)
• Gemma 4 enablement: indirect dispatch for FlashAttention graph capture, and INT64 support for Equal/Sub/Where/ReduceSum under the enable_int64 flag (#29236, #29392)
• Added a session-level buffer pool for graph capture reuse and made max_num_pending_dispatches configurable (#28761, #28894)
• Added 2-bit quantization support to GatherBlockQuantized (#29054)
• Enabled Cast to int64 by default and switched to naive reduction (#28804, #28174)
• Default non-debug validation mode is now disabled (#28679)
• Tuned parameters for the gemm-subgroup kernel (#28760)
• Enabled FlashAttention for batched GQA with right-padded prompts and fixed batched right-padded prefill with do_rotary (#29247, #29002)
• Fixed a GQA decode split-reduce head_size out-of-bounds race, the past_state == present_state buffer aliasing case, and GatherBlockQuantized dispatch failure for empty indices (#29593, #28753, #29030)
• Fixed nearest half-tie handling for round_prefer_ceil/round_prefer_floor (#28757)
• Skipped MatMulNBitsMlpFusion when the kernel is unavailable (#29089)
• Fixed profiling timestamp alignment with the ORT profiler (#29021)

CoreML EP

• Added Where and And builders (#28597)
• Fixed extended minimal builds with the Core ML EP (#29387)
• Fixed the "model_path" must not be empty error (#29394)
• Fixed CoreML-enabled static builds on macOS (#27960)

QNN EP

• Fixed a segfault in PadNodeGroupSelector::Check when dq_nodes is empty (#28733)
• Added a Gather handler for the transpose optimizer (#28755)

WebNN EP

• Added support for 8-bit MatMulNBits (#29025)
• Removed unnecessary casts around normalization ops (#29024)

OpenVINO / VitisAI / DML / XNNPACK / VSINPU

• OpenVINO EP development updates (#28954)
• VitisAI: recognize native-endian in-memory address tag in process_ext_address (#29248)
• DML: fixed batched readback size (#28680)
• XNNPACK: fixed Clip/Relu fusion when the producer output has other consumers (#28814)
• VSINPU: fixed EP build error (#29440)

CPU & Core Optimizations

MLAS

• Added AVX512 (+VNNI) 2-bit weight CPU kernels (#29064)
• Added ARM64 2-bit weight CPU kernels (#29466)
• Extended the NHWC-sans-transposes path to support depthwise convolutions, and fixed NHWC conv support gating (#28565, #29127)
• Added RISC-V RVV INT8 GEMM/GEMV, M=1 routing, and activation kernels (#28308)
• Fixed a fastmath corner case in sbgemm_neon_kernel and fixed failing KleidiAI NHWC unit tests (#28394, #29010)
• Hinted GCC >= 12 on aarch64 for bf16/fp16 capability probes (#28785)

CPU Attention & Kernels

• Added flash attention for non-quantized CPU GroupQueryAttention, plus a FP32 GEMV decode kernel (#28962, #29216)
• Fixed packed-QKV and broadcast-head bias strides in quantized GQA flash attention (#28963)
• Enabled pre-packed weight sharing for CPU MatMulNBits (#29163)
• Added int8/uint8 CPU support for SpaceToDepth and int8 for DepthToSpace (#29154)
• Fixed CPU Attention causal mask alignment and is_causal bottom-right alignment for external KV cache (#29050, #28958)
• Fixed CPU GQA NaN output for right-padded batched prompts with rotary embeddings (#29069)
• Fixed ReverseSequence returning zeros for zero-length sequences (#28759)
• Fixed a regression in RandomForestClassifier binary classification predictions (#28685)

Graph, Optimizer, and Fusion

• Fixed NHWC second-pass EP assignment cleanup (#27858)
• Rejected QDQ Gemm → QGemm fusion when alpha != 1 with bias, and validated DQ scale/zero-point shapes before QGemm fusion (#28131, #28714)
• Fixed incorrect output for QDQ Resize with non-nearest interpolation modes under ORT_ENABLE_ALL (#28454)
• Fixed INT64 initializer data propagation and the Shape → Gather → TopK rank-1 regression (#28778, #29084)
• Fixed a TransposeOptimizer type error on zero-point-less DequantizeLinear (#29192)
• Fixed SimplifiedLayerNorm fusion with a node-produced Pow exponent (#29196)
• Fixed DropQDQ not dropping Q/DQ around opset-22 MaxPool (#29201)
• Recovered Conv/ConvTranspose rank from weights when the input shape is unknown (#29149)
• Fixed STFT complex input frame offsets (#28961)

Web & JavaScript

• Forwarded WebGPU EP buffer cache mode options from JS (#29017)
• Added a Python implementation for wgsl-gen and removed the dynamic WGSL generator path (#28355, #29141)
• Switched NPM publishing to consume from the CUDA 13 pipeline, and fixed the Node.js packaging stage to use CFS (#28773, #29006)
• Fixed a Dawn parallel build race condition in the wasm_Release / build-wasm CI (#29040)

Language Bindings

Python

• Added an API for HOST_ACCESSIBLE OrtValue allocation (#28038)
• Made the TF converter tolerate a missing requests package (#28825)

Java

• Released outputHandlesArr in the OrtTrainingSession.evalStep JNI binding (#29576)

Rust

• Fixed unbounded lifetime on WithOutputTensor (#29251)

Build, Packaging & CI

• Updated the cpuinfo dependency and integrated cpuinfo_deinitialize() (#28245)
• Built with abseil 20250814 under NVCC (#28586)
• Fixed the Linux CUDA 13.3 build (abseil + CCCL parse errors) and the Windows CUDA 13.3 build for VS 2026 (#29042, #29266)
• Fixed the Windows build for SM90 and later, and CUDA packaging build errors (#29776, #29580)
• Fixed the wrong ORT version in Windows DLL VersionInfo for pipeline builds (#29545)
• Fixed Python and CUDA packaging pipeline failures (#29200, #29241)
• Installed Java in the Windows NuGet packaging job and added Java setup to the Windows x64 QNN CI pipeline (#29774, #29754)
• Sharded Windows ASan test runs and fixed ASan OOM in QDQ Gemm transformer tests (#29503, #28797)
• Propagated and fixed PIP_INDEX_URL piping for container build stages (#29803, #29823)
• Removed deprecated docfx in favor of a newer docs validation method (#29812)
• Fixed a build failure from a direct ONNX schema include in layernorm optimizer tests (#29073)
• Test stability: fixed a data race in CUDA graph tests, a non-deterministic CUDA custom-op test, a thread-pool parameter self-assignment, duplicate schema registration, and incorrect string tensor creation (#29398, #29082, #28799, #29219, #29218)
• Encapsulated the global random seed in a function and improved LinearRegressor test coverage (#28979, #29083)

Contributors

Thanks to our 103 contributors for this release!

@adrastogi, @ankitm3k, @apsonawane, @ArsalanShakil, @bachelor-dou, @bopeng1234, @cbourjau, @chilo-ms, @chunghow-qti, @chwarr, @claude, @Craigacp, @crvineeth97, @dabhattimsft, @daijh, @danielsongmicrosoft, @derdeljan-msft, @edgchen1, @elwhyjay, @ericcraw, @eserscor, @fanchenkong1, @feich-ms, @fs-eire, @FuZoe, @gaugarg-nv, @gblong1, @GopalakrishnanN, @grybouilli, @guschmue, @haoxli, @hariharans29, @hnsyprst, @Honry, @intbf, @ishwar-raut1, @jambayk, @Jaswanth51, @jatinwadhwa921, @javier-intel, @jiafatom, @Jiawei-Shao, @JonathanC-ARM, @justinchuby, @jwludzik, @Kotomi-Du, @kpkbandi, @lucka-me, @maoger, @martin-klacer-arm, @maxwbuckley, @MayureshV1, @mc-nv, @mcollinswisc, @mdvoretc-intel, @mingyueliuh, @mklimenk, @n1harika, @namgyu-youn, @neilmsft, @orlmon01, @Osamaali313, @prathikr, @preetha-intel, @psakhamoori, @qiurui144, @qjia7, @qti-hungjuiw, @qti-yuduo, @quic-muchhsu, @raagrawal, @RajeevSekar, @Reranko05, @Rishi-Dave, @RyanMetcalfeInt8, @Sammy-Dabbas, @sanaa-hamel-microsoft, @sayanshaw24, @selenayang888, @sfatimar, @sgbihu, @Shivani767, @ssam18, @susbhere, @sushraja-msft, @tairenpiao, @the0cp, @tianleiwu, @titaiwangms, @umireon, @vthaniel, @wangw-1991, @wenqinI, @xadupre, @xenova, @xhcao, @xiaofeihan1, @xieofxie, @xuke537, @yen-shi, @yinli-systems, @yuslepukhin, @ZackyLake

Full Changelog: v1.27.1...v1.28.0

This is a patch release on top of v1.27.0, containing targeted bug fixes, a CUDA QMoE decode-path optimization, and CI/build infrastructure fixes.

Bug Fixes

• [MLAS] Fixed an igemm regression in the KleidiAI path (#28571)
• Fixed a QMoE CPU livelock by eliminating nested intra-op parallelism (#29081)
• Fixed a regression in graph-capture session initialization that rejected an empty graph (#29457)
• Fixed CustomOp forward compatibility by capping the version instead of rejecting it (#29574)

Performance

NVIDIA CUDA EP

• Added a QMoE GEMV fast path for batch-1 decode (#29038)

CI & Build Infrastructure

• Fixed an incorrect identity for azcopy (#29274)
• Fixed a brew install applesimutils failure by trusting the wix/brew tap (#29450)
• Upgraded to Xcode 26 (#29468)
• Stopped echoing the command when setting a VSO variable in mac-cpu-packing-jobs.yml (#29575)
• Fixed the web e2e (npm/vite) and Python DML CI pipelines (#29609)

Contributors

Thanks to our 8 contributors for this release!

@tianleiwu, @chilo-ms, @edgchen1, @adrastogi, @damdoo01-arm, @JonathanC-ARM, @martin-klacer-arm, @sanaa-hamel-microsoft

Full Changelog: v1.27.0...v1.27.1

n.b. This release is targeting ONNX 1.21. ONNX 1.22 will be supported in ORT 1.28.
n.b. This changelog was generated via LLM. Only the contributor list has been verified. As always, only trust the commit history.

Announcements & Breaking Changes

• CUDA 12 package files are now explicitly named as such.
• CUDA 12 packages are deprecated, please move to CUDA 13 ASAP.

---

Security Fixes

• Fixed out-of-bounds read in SoftmaxCrossEntropyLoss via label bounds validation (#28004)
• Hardened OneHot input validation and output-size computation (#28014)
• Added SafeInt overflow protection in Expand and capped constant-folding output sizes (#28055)
• Bounded total output allocation size in Tile kernel (#28070)
• Added mask/input shape consistency checks in MaxpoolWithMask::Compute (#28223)
• Fixed BitShift UB for shift amounts greater than or equal to bit width (#28272)
• Validated sequence bounds in GQA (seqlens_k vs cos_cache) (#28277)
• Validated conv bias shape in WordConvEmbedding to prevent OOB reads (#28279)
• Fixed int32 overflow in CUDA Cast and UnaryElementWise kernels for very large tensors (#28386)
• Fixed out-of-bounds read in CropBase scale handling (#28399)
• Fixed rank-underflow bug in Inverse kernel trailing-dimension indexing (#28400)
• Added sparse tensor external file path validation and additional external-path hardening (#28408, #28709, #28725)
• Switched remaining torch.load() calls to weights_only=True (#28421)
• Added CPU cache-indirection beam-index validation (#28486)
• Added additional overflow/bounds checks and test coverage in runtime buffers (#28713, #28747)

---

New Features

Execution Provider Plugin API

• Added zero-copy I/O for plugin EPs with HOST_ACCESSIBLE memory (#28037)
• Added OrtEp::OnSessionInitializationEnd() callback (#28319)
• Added plugin EP session-options getters (#28377)
• Added CUDA Plugin EP provider options for streams and external allocators (#28603)

Core APIs & Runtime

• Added support for ONNX overloaded functions (IR v10+) (#28275)
• Added FLOAT8E8M0 datatype support in ONNX Runtime (#28381)
• Added CPU Cast support for FLOAT8E8M0 (#28435)
• Added kOrtEpDevice_EpMetadataKey_OSDriverVersion example and docs (#28282)

Quantization & Training Tooling

• Added calibration cache support to quantize_static (#28221)
• Added ActivationRestrictedAsymmetric quantization option (#28237)
• Added opset-21 block_size attribute support to QDQ quantization (#28522)
• Added CPU fallback for FusedAdam optimizer in ORT Training (#28233)

---

Execution Provider Updates

NVIDIA CUDA EP

• Added ConvTranspose-22 support (#27710)
• Filled CUDA opset gaps for LSTM, RNN, Reshape, Cast, Round/Equal, ReduceMax/ReduceMin, Sin/Cos, and Random* ops (#27737, #27743, #27742, #27744, #27754, #27755, #27756, #27759)
• Added LpNormalization support for CUDA EP (#28724)
• Added chunked dequant+GEMM for MatMulNBits to reduce peak GPU memory (#28712)
• Added QMoE tests for standard swiglu and improved decode-path routing/softmax kernels (#28741, #29026)
• Fixed CUDA Attention dispatch mismatch for GQA head-size cases (#28358)
• Fixed CUTLASS FMHA bias-loader alignment on unaligned kernel path (#28369)

WebGPU EP

• Added LSTM support on WebGPU (#27881)
• Added per-graph buffer manager for multi-graph capture (#28260)
• Added QKV and MLP layer fusions for Qwen3-style models (#28280)
• Added QKV bias support in FlashAttention for MultiHeadAttention (#28380)
• Added shader dump-to-file environment variable and nightly validation checks (#28674)
• Added opset-24 + KV-shared decoder support (Gemma 4) (#28501)
• Performance improvements: FlashAttention M4 Max optimization and subgroup-based LinearAttention tuning (#27780, #28412, #28519, #28520)
• Fixed numerical and correctness issues in QMoE, LayerNorm/SkipLayerNorm, and MatMul bias indexing (#28427, #28434, #28475)

CoreML EP

• Added support for pre-opset-13 Split (split attribute path) and scalar Gather indices (#28270, #28278)
• Added FusedConv, Identity, Ceil, Tile, Cast(bool), Sin, Cos, and GatherND support (#28289, #28293, #28595, #28596, #28598)

TensorRT / DML / QNN

• Improved TensorRT RTX compatibility (multi-GPU tests, API guards, and subgraph fixes) (#27837, #28361, #28611, #28503)
• Added diagnostics for DML failure paths (#28495)
• Updated QNN ETW log level rule handling (#27593)

---

Web & JavaScript

JavaScript / Node.js

• Updated JavaScript dependencies (next, postcss, tmp, qs, body-parser, and other npm packages) (#27705, #27894, #28304, #28547, #28644, #28683, [#28694]

---

CPU & Core Optimizations

MLAS / Quantization / Attention

• Added NHWC convolution path in MLAS to reduce transpose overhead (#26834)
• Added CPU QMoE 2-bit support and LUT GEMM fast path (#28185)
• Added quantized KV-cache support for CPU GroupQueryAttention with SIMD optimizations and tiled compute (#28576, #28578, #28606, #28695)
• Added RVV-optimized NCHWc convolution/pooling and LLM operators for RISC-V (#28411, #28518)
• Parallelized CPU ScatterElements and optimized MatMulNBits 2-bit float-zero-point path (#28588, #28589)
• Added optional bias support in MatMulNBits CPU LUT GEMM path (#28742)

Graph, Optimizer, and Fusion

• Added DiT attention fusion for F5-TTS and diffusion transformer models (#27999)
• Improved ONNX Attention dispatch path and removed legacy unfused MHA path (#27992)
• Added support for optional present_key/present_value outputs in GQA and Gemma4 support (#28242)
• Added implicit-input handling for partitioning/fusion around control-flow nodes (#28608, #28690)

---

Language Bindings

Python

• Fixed runtime-unresolvable type annotations in Session and InferenceSession (#27802)
• Made sympy an optional runtime dependency (#28141)
• Added PEP 561 py.typed marker to the onnxruntime package (#28438)

C#

• Added EP tests for CUDA Plugin EP (#28375)

---

Bug Fixes

Critical & Correctness Fixes

• Fixed session use-after-free when UserLoggingFunction is used (#28314)
• Prevented double-free in OrtModelEditorApi ownership transfer (#28123)
• Fixed plugin EP provider-library load refcount leak and added regression test (#28396, #28430)
• Fixed dangling pointer from temporary return value (#28419)
• Fixed PRelu returning NaN for infinite inputs on CPU EP (#28750)
• Fixed CPU Attention softcap/attn_mask ordering and added CUDA spec coverage consolidation (#28379)
• Fixed Reshape allowzero=1 handling for chained zero-size tensors (#28455)
• Fixed CPU QLinearConv per-channel weight zero-point handling for distinct values (#28456)
• Fixed Unicode-path handling issues on Windows and AppContainer path canonicalization (#28390, #28509)

Portability Fixes

• Build and portability fixes across AIX, GCC-15, S390x, libc++/Clang, FreeBSD, and cross-compilation flows (#26704, #27191, #28016, #28049, #28074, #28362, #28567, #28507)
• Fixed CPUIDInfo bounds handling for unknown ARM vendors (#28344)
• Fixed Resize nearest-mode rounding bug for negative halfway values (#28345)

---

Contributors

Thanks to our 106 contributors for this release!

@adrastogi, @adrianlizarraga, @AIFrameworksIntegration, @AlekseiNikiforovIBM, @angelser, @angelserMS, @ankitm3k, @anzzraju1997-glitch, @apsonawane, @arajendra, @ayappanec, @bachelor-dou, @badranX, @baijumeswani, @BoarQing, @bopeng1234, @bsosnader, @cbourjau, @chilo-ms, @chunghow-qti, @chwarr, @Craigacp, @daijh, @derdeljan-msft, @dparikh79, @edgchen1, @elwhyjay, @ericcraw, @eserscor, @feich-ms, @fs-eire, @gaugarg-nv, @gblong1, @GopalakrishnanN, @gramalingam, @guschmue, @hariharans29, @HectorSVC, @intbf, @ishwar-raut1, @Jaswanth51, @jatinwadhwa921, @javier-intel, @jchen10, @jiafatom, @Jiawei-Shao, @jnagi-intel, @jocelyn-stericker, @JonathanC-ARM, @justinchuby, @jwludzik, @kevinch-nv, @Kotomi-Du, @kpkbandi, @KV2773, @Laan33, @lhrios, @maxwbuckley, @MayureshV1, @mdvoretc-intel, @mingyueliuh, @mklimenk, @mustjab, @n1harika, @nazanin-beheshti, @orlmon01, @prathikr, @preetha-intel, @psakhamoori, @qiurui144, @qjia7, @qti-ashwshan, @qti-hungjuiw, @qti-yuduo, @rajatmonga, @RajeevSekar, @Rishi-Dave, @rvandermeulen, @RyanMetcalfeInt8, @SamuelLess, @sanaa-hamel-microsoft, @sfatimar, @sgbihu, @shiyi9801, @simonbyrne, @skottmckay, @susbhere, @sushraja-msft, @tairenpiao, @TejalKhade28, @theHamsta, @tianleiwu, @titaiwangms, @umangb-09, @velonica0, @vraspar, @vthaniel, @wenqinI, @xadupre, @xenova, @xhan65, @xiaofeihan1, @xieofxie, @yuslepukhin, @ZackyLake, @zejianzhang1982, @zz002

Full Changelog: v0.1.4...v1.27.0

n.b. The following was generated via LLM from Git history. Only the contributor list has been verified.

Announcement - Breaking Changes

• Support for CUDA 12 will be removed in 1.27.0.
  • CUDA 13 will continue to be published as onnxruntime-<os>-<arch>-gpu_cuda13-<version>.<ext>
• CUDA runtime will be moving soon to a dedicated Execution Provider (EP) instead of a published package from ORT core.

Highlights

• Added optional memory mapping for .ort model loads (#28164).
• Added RISC-V Vector (RVV) support for CPU EP (#28261).
• OpenVINO EP upgraded for 1.26.0 development release (#28297).
• WebGPU gained GridSample support (#28264) and Split-K improvements (#28151).
• CUDA plugin EP gained graph support (#28002), profiling API (#28216).

Security and Reliability Hardening

• Replaced unrestricted Python setattr configuration with an allowlist (#28083).
• Hardened multiple OOB and overflow scenarios across ML and core ops:
  • Attention mask index OOB write (#27789).
  • MaxPoolGrad indices bounds validation (#27903).
  • SVM and TreeEnsemble bounds/security fixes (#27950, #27951, #27952, #27989).
  • RNN sequence_lens OOB read and integer overflow handling (#28052, #28003).
  • GroupQueryAttention seqlens_k bounds validation and compatibility follow-up (#28031, #28259).
  • MatMulBnb4 and ML coefficient SafeInt checks (#27995, #28001).
  • CUDA Gather int32 overflow fix (#28108).
  • GridSample float->int64 cast hardening for NaN/Inf/out-of-range coords (#28302).
• Fixed session logger use-after-free during EP teardown under verbose logging (#28274).

CUDA, Attention, and MLAS

• Filled CUDA opset/operator gaps and extended support:
  • Transpose opset 23 -> 25 (#27740).
  • QuantizeLinear/DequantizeLinear opset 25 (#28046).
  • CUDA TopK INT8/INT16/UINT8 support (#27862).
  • LabelEncoder CUDA support for numeric types (#28045).
• Attention/GQA improvements:
  • Fixed ONNX Attention min-bias alignment crash on SM<80 and masked-batch NaN behavior (#27831).
  • Added FP32 QK accumulation path for unfused GQA attention (#28198).
  • Added CUDART_VERSION reduction compatibility in GQA attention (#28296).
  • Fixed CUDA 13 build error in GQA unfused attention (#28309).
  • PagedAttention fallback for SM<80 fp16 (#28200).
• MLAS updates:
  • FP16 Gelu enablement (#26815).
  • Arm64 BF16 fast-math conv kernels for NCHW/NCHWc paths (#27878).

WebGPU, WebNN, and JavaScript

• WebGPU feature and correctness updates:
  • Added GridSample (#28264).
  • Split-K support for batch size > 1 (#28151).
  • MatMulNBits refactor and batching improvements (#28109, #28197).
  • MHA correctness fix when present outputs are not requested (#28027).
  • Buffer upload overflow fix (#27948).
  • Position ID bounds validation in WebGPU/JS RotaryEmbedding (#28214).
• WebNN change:
  • Renamed pool2d property roundingType -> outputShapeRounding (#28172).
• JavaScript ecosystem maintenance:
  • Multiple dependency bumps.

Plugin EP and EP Ecosystem

• CUDA plugin EP:
  • Graph capture/replay support ported and expanded (#27958, #28002).
  • Sync support for IOBinding (#27919).
  • Profiling API implementation (#28216).
  • Resource accounting integration (#28028).
• WebGPU plugin EP:
  • Pipeline updates and API init error handling fixes (#28121, #28211).
• Other EP updates:
  • CoreML: HardSigmoid and QuickGelu support; Pad reflect support/fixes (#28182, #28184, #28073, #28062).
  • NvTensorRTRTX compatibility and diagnostics updates (#28263, #27577).
  • QNN file-mapping guard improvements (#27871).

Contributors

@tianleiwu, @yuslepukhin, @edgchen1, @vraspar, @hariharans29, @skottmckay, @eserscor, @xadupre, @sanaa-hamel-microsoft, @elwhyjay, @Rishi-Dave, @titaiwangms, @adrianlizarraga, @jatinwadhwa921, @jchen10, @Jiawei-Shao, @maxwbuckley, @preetha-intel, @qjia7, @qti-hungjuiw, @RajeevSekar, @umangb-09, @adrastogi, @akote123, @amd-genmingz, @ankitm3k, @apsonawane, @bachelor-dou, @baijumeswani, @bopeng1234, @chilo-ms, @chwarr, @Craigacp, @dccarmo, @derdeljan-msft, @ericcraw, @fdwr, @fs-eire, @gaugarg-nv, @gblong1, @GopalakrishnanN, @Honry, @intbf, @ishwar-raut1, @Jaswanth51, @javier-intel, @JonathanC-ARM, @julia-thorn, @justinchuby, @jwludzik, @Kevin-Taha, @Kotomi-Du, @MayureshV1, @mdvoretc-intel, @miaobin, @milpuz01, @mingyueliuh, @mklimenk, @n1harika, @prathikr, @psakhamoori, @qti-yuduo, @quic-calvnguy, @RyanMetcalfeInt8, @sfatimar, @sgbihu, @ShirasawaSama, @ssam18, @susbhere, @sushraja-msft, @TejalKhade28, @theHamsta, @TomCrypto, @TsofnatMaman, @velonica0, @vthaniel, @wenqinI, @xhan65, @xhcao

n.b. This changelog is LLM generated. Only the contributor listing has been verified.

ONNX Runtime Release 1.25.1

📢 Announcements & Breaking Changes

ONNX Op Updates

• Enhanced ONNX operator support with new opset versions: Reshape (opset 25), Transpose (opset 24) (#27752)

---

✨ New Features

📊 New ONNX Ops & Model Support

• LinearAttention and CausalConvState operators for Qwen3.5 model support (#27907)
• RotaryEmbedding (RotEMB) and RMSNorm operators added (#27752)
• Linear Attention signature support (#27842)

---

🌐 Web & JavaScript

WebGPU EP

• Qwen3.5 model support on WebGPU execution provider (#27996)
• QMoE 1-token decode path optimization — fused operations to reduce GPU dispatches for improved performance (#27998)

---

🐛 Bug Fixes

Core Runtime Fixes

• Improved filesystem error messages during Linux device discovery for better debugging experience (#27289)
• Fixed missing include for SetRawDataInTensorProto in NVIDIA TensorRT RTX tests (#28065)

---

🙏 Contributors

Thanks to our 7 contributors for this release:
@guschmue, @sanaa-hamel-microsoft, @apsonawane, @eserscor, @ishwar-raut1, @qjia7, @theHamsta

Full Changelog: v1.25.0...v1.25.1